replicas-engine 0.1.740 → 0.1.742

package/dist/src/{chunk-3Z7CQNGC.js → chunk-OGIXPGJ6.js}

@@ -7,15 +7,12 @@ import {
   agentCredentialSnapshotSchema,
   createErrorResult,
   createSuccessResult,
-  extractCommandProtectionCommandText,
   fallbackPlanResponseSchema,
-  findGitCommitSignals,
-  findPrMergeSignals,
   isRecord,
   isValidAgentProvider,
   parsePosixEnvFile,
   readReplicasRuntimeEnv
-} from "./chunk-YPAI4W4G.js";
+} from "./chunk-RYGOTMEM.js";
 
 // src/engine-env.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -129,6 +126,8 @@ function loadEngineEnv() {
     REPLICAS_SLACK_THREAD_TS: readReplicasRuntimeEnv(readEnv, REPLICAS_RUNTIME_ENV_ALIASES.slackThreadTs),
     ANTHROPIC_API_KEY: readEnv("ANTHROPIC_API_KEY"),
     OPENAI_API_KEY: readEnv("OPENAI_API_KEY"),
+    CODEX_OPENAI_BASE_URL: readEnv("CODEX_OPENAI_BASE_URL"),
+    CODEX_OPENAI_AUTHORIZATION_HEADER: readEnv("CODEX_OPENAI_AUTHORIZATION_HEADER"),
     CURSOR_API_KEY: readEnv("CURSOR_API_KEY"),
     AI_GATEWAY_API_KEY: readEnv("AI_GATEWAY_API_KEY"),
     CLAUDE_CODE_USE_BEDROCK: readEnv("CLAUDE_CODE_USE_BEDROCK"),
@@ -232,71 +231,10 @@ var MonolithService = class {
 };
 var monolithService = new MonolithService();
 
-// src/services/command-protection-service.ts
-var DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE = "Blocked by Replicas command protection.";
-function asCommandProtectionResponse(value) {
-  if (typeof value !== "object" || value === null) return null;
-  const candidate = value;
-  return typeof candidate.allowed === "boolean" && typeof candidate.enabled === "boolean" ? candidate : null;
-}
-function failClosed(reason, matchedSignals) {
-  return {
-    allowed: false,
-    enabled: true,
-    reason,
-    matchedSignals
-  };
-}
-async function evaluateCommandProtection(request, signal) {
-  const matchedSignals = [...findGitCommitSignals(request), ...findPrMergeSignals(request)];
-  if (matchedSignals.length === 0) {
-    return { allowed: true, enabled: true };
-  }
-  let response;
-  try {
-    response = await monolithRequest("/v1/engine/command-protection/evaluate", {
-      body: request,
-      signal
-    });
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
-  }
-  if (!response.ok) {
-    const detail = await response.text().catch(() => "");
-    return failClosed(`Command protection failed closed: ${response.status} ${detail}`, matchedSignals);
-  }
-  let payload;
-  try {
-    payload = await response.json();
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return failClosed(`Command protection failed closed: ${detail}`, matchedSignals);
-  }
-  return asCommandProtectionResponse(payload) ?? failClosed("Command protection failed closed: invalid response from policy service", matchedSignals);
-}
-function extractToolCommand(input) {
-  return extractCommandProtectionCommandText({ toolInput: input }, { stringifyFallback: false });
-}
-function reportCommandProtectionBlock(options) {
-  const message = options.result.reason || DEFAULT_COMMAND_PROTECTION_BLOCK_MESSAGE;
-  console.warn(`[${options.managerName}] blocked ${options.action} by command protection: ${message}`);
-  options.recordHistoryEvent(options.eventType, {
-    type: "error",
-    message,
-    ...options.context,
-    command: options.command
-  }, options.historyFile);
-  return message;
-}
-
 export {
   IS_WARMING_MODE,
   ENGINE_ENV,
   setAgentCredentialSnapshot,
   monolithRequest,
-  monolithService,
-  evaluateCommandProtection,
-  extractToolCommand,
-  reportCommandProtectionBlock
+  monolithService
 };

package/dist/src/{chunk-7SUFESKA.js → chunk-PNTBK7LZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   mayCreatePullRequest
-} from "./chunk-YPAI4W4G.js";
+} from "./chunk-RYGOTMEM.js";
 
 // src/services/post-tool-pr-notifier.ts
 async function notifyPostToolUse(toolName, toolInput) {

package/dist/src/{chunk-YPAI4W4G.js → chunk-RYGOTMEM.js}

@@ -289,6 +289,9 @@ function getAgentModelOptions(provider, overrides) {
 var CLAUDE_MODEL_MIN_SANDBOX_IMAGE = {
   [CLAUDE_FABLE_5_1_MODEL]: "replicas-sandbox-2026-09-01-v6"
 };
+var CODEX_MODEL_MIN_SANDBOX_IMAGE = {
+  [GPT_6_ASTRA_MODEL]: "replicas-sandbox-2026-09-04-v7"
+};
 var MODEL_LABELS = {
   fable: "Fable 5.1",
   [CLAUDE_FABLE_5_1_MODEL]: "Fable 5.1",
@@ -539,6 +542,21 @@ function getCredentialMethodLabel(agent, method) {
   }
 }
 
+// ../shared/src/result.ts
+function createSuccessResult(data) {
+  return { ok: true, data };
+}
+function createErrorResult(error) {
+  return {
+    ok: false,
+    error: {
+      message: error.message,
+      code: error.code,
+      details: error.details
+    }
+  };
+}
+
 // ../shared/src/analytics/types.ts
 function hasAgentChatActivityFields(value) {
   return isRecord(value) && typeof value.chatId === "string" && typeof value.model === "string" && (value.credentialMethod === void 0 || isAuthMethod(value.credentialMethod)) && (value.credentialScope === void 0 || isCredentialScope(value.credentialScope)) && value.credentialMethod === void 0 === (value.credentialScope === void 0) && (value.senderUserId === void 0 || typeof value.senderUserId === "string") && typeof value.occurredAt === "string";
@@ -977,21 +995,6 @@ function getMemoryOutputSafetyViolation(value, secrets, maxChars) {
   return null;
 }
 
-// ../shared/src/result.ts
-function createSuccessResult(data) {
-  return { ok: true, data };
-}
-function createErrorResult(error) {
-  return {
-    ok: false,
-    error: {
-      message: error.message,
-      code: error.code,
-      details: error.details
-    }
-  };
-}
-
 // ../shared/src/sandbox.ts
 var SANDBOX_LIFECYCLE = {
   AUTO_STOP_MINUTES: 60,
@@ -6354,6 +6357,8 @@ function hasChatStarted(chat) {
 // ../shared/src/routes/codex.ts
 var CODEX_AUTH_ENV_KEYS = [
   "OPENAI_API_KEY",
+  "CODEX_OPENAI_BASE_URL",
+  "CODEX_OPENAI_AUTHORIZATION_HEADER",
   "AZURE_OPENAI_API_KEY",
   "CODEX_FOUNDRY_BASE_URL",
   "CODEX_FOUNDRY_MODEL",
@@ -6364,7 +6369,12 @@ function codexAuthEnvFromResponse(response) {
     case "oauth":
       return { REPLICAS_CODEX_AUTH_METHOD: "oauth" };
     case "api_key":
-      return { OPENAI_API_KEY: response.apiKey, REPLICAS_CODEX_AUTH_METHOD: "api_key" };
+      return {
+        ...response.apiKey && !response.authorizationHeader ? { OPENAI_API_KEY: response.apiKey } : {},
+        ...response.baseUrl ? { CODEX_OPENAI_BASE_URL: response.baseUrl } : {},
+        ...response.authorizationHeader ? { CODEX_OPENAI_AUTHORIZATION_HEADER: response.authorizationHeader } : {},
+        REPLICAS_CODEX_AUTH_METHOD: "api_key"
+      };
     case "foundry":
       return {
         AZURE_OPENAI_API_KEY: response.apiKey,
@@ -6377,7 +6387,12 @@ function codexAuthEnvFromResponse(response) {
 var CODEX_AUTH_ENV_KEYS_BY_METHOD = {
   none: [],
   oauth: ["REPLICAS_CODEX_AUTH_METHOD"],
-  api_key: ["OPENAI_API_KEY", "REPLICAS_CODEX_AUTH_METHOD"],
+  api_key: [
+    "OPENAI_API_KEY",
+    "CODEX_OPENAI_BASE_URL",
+    "CODEX_OPENAI_AUTHORIZATION_HEADER",
+    "REPLICAS_CODEX_AUTH_METHOD"
+  ],
   bedrock: [],
   foundry: ["AZURE_OPENAI_API_KEY", "CODEX_FOUNDRY_BASE_URL", "CODEX_FOUNDRY_MODEL", "REPLICAS_CODEX_AUTH_METHOD"]
 };

package/dist/src/chunk-Z6P6S5HL.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+
+// src/utils/presigned-upload.ts
+import { createReadStream } from "fs";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+async function putPresignedFile(urlValue, filePath, size, contentType) {
+  await new Promise((resolve, reject) => {
+    const url = new URL(urlValue);
+    const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
+      method: "PUT",
+      headers: {
+        "content-length": String(size),
+        "content-type": contentType
+      }
+    }, (response) => {
+      response.setEncoding("utf8");
+      let body = "";
+      response.on("data", (chunk) => {
+        body += chunk;
+      });
+      response.on("end", () => {
+        const status = response.statusCode ?? 0;
+        if (status >= 200 && status < 300) resolve();
+        else reject(new Error(`upload failed: ${status} ${body}`));
+      });
+      response.on("error", reject);
+    });
+    request.on("error", reject);
+    const file = size > 0 ? createReadStream(filePath, { start: 0, end: size - 1 }) : createReadStream(filePath);
+    file.on("error", (error) => request.destroy(error));
+    file.pipe(request);
+  });
+}
+
+// src/managers/codex-asp/notification-dispatch.ts
+var TURN_STARTED_METHOD = "turn/started";
+var TURN_COMPLETED_METHOD = "turn/completed";
+var TURN_PLAN_UPDATED_METHOD = "turn/plan/updated";
+var THREAD_GOAL_UPDATED_METHOD = "thread/goal/updated";
+var THREAD_GOAL_CLEARED_METHOD = "thread/goal/cleared";
+var ITEM_STARTED_METHOD = "item/started";
+var ITEM_COMPLETED_METHOD = "item/completed";
+var AGENT_MESSAGE_DELTA_METHOD = "item/agentMessage/delta";
+var REASONING_SUMMARY_TEXT_DELTA_METHOD = "item/reasoning/summaryTextDelta";
+var REASONING_TEXT_DELTA_METHOD = "item/reasoning/textDelta";
+var REASONING_SUMMARY_PART_ADDED_METHOD = "item/reasoning/summaryPartAdded";
+var COMMAND_EXECUTION_OUTPUT_DELTA_METHOD = "item/commandExecution/outputDelta";
+var FILE_CHANGE_OUTPUT_DELTA_METHOD = "item/fileChange/outputDelta";
+var ACCOUNT_RATE_LIMITS_UPDATED_METHOD = "account/rateLimits/updated";
+var THREAD_TOKEN_USAGE_UPDATED_METHOD = "thread/tokenUsage/updated";
+var THREAD_COMPACTED_METHOD = "thread/compacted";
+var MODEL_REROUTED_METHOD = "model/rerouted";
+function dispatchAspNotification(notification, handlers) {
+  const handler = handlers[notification.method];
+  if (!handler) return;
+  handler(notification);
+}
+function recoverCompletedTurn(turn, completedItems, agentMessageDeltas) {
+  const items = turn.items.length > 0 ? [...turn.items] : [];
+  const itemIds = new Set(items.map((item) => item.id));
+  for (const item of completedItems) {
+    if (itemIds.has(item.id)) continue;
+    items.push(item);
+    itemIds.add(item.id);
+  }
+  for (const [itemId, text] of agentMessageDeltas) {
+    if (itemIds.has(itemId)) continue;
+    items.push({ type: "agentMessage", id: itemId, text, phase: null, memoryCitation: null });
+  }
+  return items.length > 0 ? { ...turn, items, itemsView: "full" } : turn;
+}
+
+export {
+  putPresignedFile,
+  TURN_STARTED_METHOD,
+  TURN_COMPLETED_METHOD,
+  TURN_PLAN_UPDATED_METHOD,
+  THREAD_GOAL_UPDATED_METHOD,
+  THREAD_GOAL_CLEARED_METHOD,
+  ITEM_STARTED_METHOD,
+  ITEM_COMPLETED_METHOD,
+  AGENT_MESSAGE_DELTA_METHOD,
+  REASONING_SUMMARY_TEXT_DELTA_METHOD,
+  REASONING_TEXT_DELTA_METHOD,
+  REASONING_SUMMARY_PART_ADDED_METHOD,
+  COMMAND_EXECUTION_OUTPUT_DELTA_METHOD,
+  FILE_CHANGE_OUTPUT_DELTA_METHOD,
+  ACCOUNT_RATE_LIMITS_UPDATED_METHOD,
+  THREAD_TOKEN_USAGE_UPDATED_METHOD,
+  THREAD_COMPACTED_METHOD,
+  MODEL_REROUTED_METHOD,
+  dispatchAspNotification,
+  recoverCompletedTurn
+};

package/dist/src/command-protection-hook.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import {
   evaluateCommandProtection
-} from "./chunk-3Z7CQNGC.js";
+} from "./chunk-AKQ6IVUU.js";
+import "./chunk-OGIXPGJ6.js";
 import {
   isRecord
 } from "./chunk-2RB7SIP3.js";
-import "./chunk-YPAI4W4G.js";
+import "./chunk-RYGOTMEM.js";
 
 // src/command-protection-hook.ts
 var provider = process.argv[2];

package/dist/src/deepseek-command-protection-plugin.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import {
   evaluateCommandProtection
-} from "./chunk-3Z7CQNGC.js";
+} from "./chunk-AKQ6IVUU.js";
 import {
   notifyPostToolUse
-} from "./chunk-7SUFESKA.js";
+} from "./chunk-PNTBK7LZ.js";
+import "./chunk-OGIXPGJ6.js";
 import "./chunk-2RB7SIP3.js";
-import "./chunk-YPAI4W4G.js";
+import "./chunk-RYGOTMEM.js";
 
 // src/deepseek-command-protection-plugin.ts
 function replicasCommandProtection(context) {

package/dist/src/headless-agent.js

@@ -1,15 +1,17 @@
 #!/usr/bin/env node
 import {
-  AppServerProcess,
-  buildCodexAgentEnv,
   putPresignedFile,
   recoverCompletedTurn
-} from "./chunk-ZZRN6VSK.js";
+} from "./chunk-Z6P6S5HL.js";
+import {
+  AppServerProcess,
+  buildCodexAgentEnv
+} from "./chunk-6X53Z7IV.js";
 import {
   AGENT,
   getMemoryOutputSafetyViolation,
   headlessAgentRequestSchema
-} from "./chunk-YPAI4W4G.js";
+} from "./chunk-RYGOTMEM.js";
 
 // src/headless-agent.ts
 import { createHash } from "crypto";